Next: SSL Analyzer, Previous: analy Analyzer, Up: Analyzers and Events
signature
Analysis ScriptThe signature
module analyzes signature matches
(see Signatures).
For each signature, you can specify one of the actions
defined in Table 7.2.
In addition, the module identifies two types of exploit scans:
horizontal (a host triggers a signature for multiple destinations) and
vertical (a host triggers multiple signature for the same destination).
signature_match (state: signature_state, msg: string, data: string)
'event
action (See Actions).
It provides the following redefinable variables:
sig_actions : table[string] of count
'Action | Meaning
|
SIG_IGNORE | Ignore the signature completely.
|
SIG_QUIET | Process for scan detection but don't report individually.
|
SIG_FILE | Write matches to signatures-log
|
SIG_FILE_BUT_NOT_SCAN | Same, but ignore for scan processing
|
SIG_ALARM | Alarm and write to signatures, notice, and alarm files
|
SIG_ALARM_ONCE | Same, but only for the first instance
|
SIG_ALARM_PER_ORIG | Same, but once per originator
|
SIG_ALARM_NO_WORM | Same, but ignore if generated by known worm-source
|
SIG_COUNT_PER_RESP | Count per destination and alarm if threshold reached
|
SIG_SUMMARY | Don't alarm, but generate per-originator summary
|
Table 7.8: Possible actions to take for signatures matches
Default: SIG_FILE
.
horiz_scan_thresholds : set[count]
'Default: { 5, 10, 50, 100, 500, 1000}
vert_scan_thresholds : set[count]
'Default: { 5, 10, 50, 100, 500, 1000}
The module defines one function for external use:
has_signature_matched (id: string, orig: addr, resp: addr): bool
'